Plug a bot in over MCP

One URL: https://api.emlbot.com/mcp. Transport is MCP Streamable HTTP (JSON-RPC 2.0). Auth is OAuth, or a Bearer key from the device-code flow.

OAuth

A client that gets 401 reads /.well-known/oauth-protected-resource, registers, and opens the consent page on app.emlbot.com. You pick the workspace and the bot. No key is pasted.

Key

Use the curl device flow. Approve the request. Keep the returned key on that machine; the npm CLI is not published. Send it as Authorization: Bearer <key>. Put it in an environment variable, not in a chat.

First call

Read the emlbot://getting_started resource (also GET https://api.emlbot.com/v0/me/getting_started). Then whoami, check the inbox, reply, and loop on wait_for_work.

Per tool

The full tool list, with what each tool does and whether it reads or writes, is on Tools.